Deprecated: Assigning the return value of new by reference is deprecated in /home/nicholas/public_html/ggnew/components/libraries/cmslib/spframework.php on line 101

Deprecated: Assigning the return value of new by reference is deprecated in /home/nicholas/public_html/ggnew/components/libraries/cmslib/spframework.php on line 644
What's New?
What's New?
The Car Kracker
All News - Projects
Written by Nicholas McClanahan   
Monday, 30 July 2012 08:54
Learn how to hack your car

Want to unlock your car door with your phone?  Re-map steering wheel buttons, or log performance data?  The Car Kracker an open-source addon for your car that lets you;

  • Add an Aux-In or music jukebox
  • Remap steering wheel buttons
  • Remove the Nav warning screen
  • Display text like emails and SMS on your Sat Nav, radio, or dashboard
  • Access engine and performance data like air/fuel ratio, oil pressure/temp, and VANOS
  • Code retrofit parts like rain sensors, run-flat tires, theft alarms, and keys
  • Access the proprietary error logs to troubleshoot engine, transmission, or accessory problems.

You can also upgrade Engine / Transmission firmware, remove the speed limiter,  reset warning lights, and change dealer settings.  Here's a little demo of displaying a tweet on the radio;

Background on developing the hack is right here.


The Car Kracker is a microcontroller with a bit of hardware to talk to your car.  It plugs into a connector in the trunk and has several default modes built-in;

  • Audio Jukebox Mode: Play music stored on an SD card
  • Advanced Diagnostics Mode: Remove the Nav warning screen, access error logs and read / modify ECU characteristics
  • Bus Sniffer: Display data traffic and send test packets
  • Audio Aux-In Mode: Enable Aux input to stereo headunits
Everything is open source, so it be customized and the firmware can be updated via USB.  A few ideas;
  • Traffic Camera Alerter
  • Automatic Audio sync
  • Auto Unlock: Unlock the doors when a specific Bluetooth device comes within range
  • Data logger + phone home: Automatically send car location and speed via SMS
Will it work with my car?
The Car Kracker uses ISO 9141, which is common for most Honda, Chrysler, Toyota, VW, and BMW's from 1995-2005.  However, the commands vary between manufacturers and models.  The Car Kracker can be programmed to support other cars, but out of the box it should work with;
  • BMW
    • 3-Series, 1998 - 2007 (e46)
    • 5-Series, 1995 - 2004 (e39)
    • 7-Series, 1994 - 2001 (e38)
    • X3, 2004 - 2010 (e83)
    • X5, 1999 - 2006 (e53)
    • Z4, 2002 - 2008 (e85, e86)
  • Mini
    • One / Cooper / S, 2001 - 2006 (r50, r53)
    • Convertible, 2005-2008 (r52)
  • Land Rover
    • Range Rover, 1999 - 2003 (L30)
The Car Kracker builds on many people's work - Many thanks to Dr_Acula for respinning RS232, Jochen @ Navcoder, the BMWCoders forums, Rayman for audio playback, e46fanatics, and bimmerforums. Thanks Everybody!


Below are the parts you'll need to build your own Car Kracker - We also offer a kit that includes everything you need right here.  The kit also comes pre-programmed and includes a USB cable and spacers.

Parts List

  • P8X32A + Quick Proto
  • Qty 47: Pin headers
  • Resistors;
    • 1x 22k ohm, 1/4 Watt Resistor
    • 5x 10k ohm, 1/4 Watt Resistors
  • Diodes;
    • 1x 1n4148 Diode
    • 1x 2n3904 BJT Transistor
  • SD Card slot (Hirose DM-3D-SF)

The kit comes pre-programmed, but if you're building it yourself, you can grab the sourcecode right here.  Here's the circuit we're going to build;
The TX and RX lines connect to the microcontroller you're going to use.  Check to make sure you have everything you need and warm up your soldering iron.


Let's start by adding the 10k Resistors, they're marked with  Brown - Black - Orange stripes and the 22k resistor;

Save the extra leads as you trim them off each resistor.

The diode and transistor - note the black stripe on one side of the diode.  That side points down, as shown in the photo. The flat side of the transistor points down, too;
Using the extra wire from the resistors, add 5 jumpers to the board, I've marked them in the photo

Add the audio and bus connectors;

Now the microSD card slot - note that you don't have to add this unless you want the audio jukebox features.

Now the power connector and finally the header. It's easiest to first insert the header pins into the P8X32A board, then put your Quick Proto board on top

Assembly's all done.  Let's test it out!

Connect to your Car

First, let's locate the data bus on your car;

1 - The Trunk
Even if your car didn't come with a CD changer, it's nearly always pre-wired for it.  Open up your trunk and explore behind the felt panel on the driver's side.  You'll find three cables - The 3 pin cable is your bus connection, and the 6 pin cable is the analog audio input to your stereo.  You don't need the big 20 pin connector. 

Plug the 3 pin and 6 pin cables into your Car Kracker;

2 - OBD2 Connector
The Trunk connection lets you access all the accessories in the car, but not the Engine Control Unit or Transmission Control Unit.  To access the engine and transmission, you'll need to connect through the 'On Board Diagnostics' connector.  It's in the car under the steering wheel, and looks like this;

Use a bit of jumper wire to connect each pin of the Car Kracker to these OBD pins;

The leftmost pin on the Car Kracker connects to pin 7 and pin 8 on the OBC port.  The middle pin doesn't get connected.  The rightmost pin gets connected to pin 5.

3 - Diagnostic Connector
Some cars will also have a diagnostic connector under the hood - mine has a huge connector which includes bus connections, and a couple other random things (like two connectors to reset the oil change reminder);

For the BMW 'Pacman' connector, connect the two data lines to the leftmost pin on your Car Kracker, and the Ground port to the rightmost pin.

When doing diagnostics, I usually use the Pacman connector - for audio and entertainment, I use the trunk connector.

Using it: Connection Test

Let's start by doing the connection test; power up your Car Kracker and hold the button labelled P4.  That will start the connection test and blink the 'Clown Nose' light on the mirror on and off.  Here's what it looks like;

Using it: Aux-In

If you boot up the Car Kracker without holding a button and without an SD card, you'll enter Audio Aux-In mode.  This mode lets you connect any MP3 player or even bluetooth player and listen to it on your stereo.  Here's how to set it up;


The 6-pin header in the trunk connects to an analog audio input to your stereo.  Unfortunately, the stereo won't tune into that audio input unless it thinks there's a CD changer connected in your car. 

The Car Kracker solves that problem by pretending to be a CD changer.  Your stereo will think there's a CD changer and amplify whatever signal is coming in the analog in line.  Here's how to set it up;

Step 1: CD Changer Emulation
With the Car Kracker connected to your car, turn it on without inserting an SD card.  After a few moments, it will be CD changer emulation mode.  Whatever audio signals come in through the CD changer audio connection will be played on your stereo.

Step 2: Headphone Jack Connection
You can connect whatever audio source directly to the 6-pin header in the trunk, although that can be inconvenient.  You can use a Bluetooth A2DP adapter and play audio from your cell phone over bluetooth, or you can connect your audio source directly to your stereo.   On the BMW 3-Series, you just pry off the fake wood panels on the dash with a butter knife.  First the passenger side panel, then the middle panel;

and remove the two screws holding in the stereo;

Remove the connectors off the back and slide out the stereo;

You'll want to connect your left channel, right channel, and ground to the pins on the bottom;

You can run that cable out to the sunglasses box under the stereo or to the glove box.

A few notes on Aux-In;
  • Your Car Kracker has to be powered up and connected to the car whenever you want to use Aux-input.  You can power it up with 4xAA's batteries or connect it to a USB car charger.
  • Not all head units need CD changer emulation - some have a second set of audio connectors just for Aux-input.  In that case, you just need to construct a cable.

Using it: Audio Jukebox

If you want to keep everything in the trunk, the Car Kracker can play back audio files stored on the SD card.  Just boot up the Car Kracker with an SD card connected and it will enter Audio Jukebox mode.  Here's how to use it;

Jukebox Mode

Step 1: Pick your tunes
The Car Kracker plays back 44khz and 48khz stereo wav files so your MP3's and AAC's will need to be converted.  I use Audacity for this - conversion takes just a few minutes.

Step 2: Load 'em up
SD cards up to 32GB are supported, copy your songs over to the SD card, cards up to 32GB are supported.  You can use the buttons on your radio to move between albums and tracks - Albums are grouped by filename, your SD card should look something like this;
  • 01_01.wav
  • 01_02.wav
  • 01_03.wav
  • 02_01.wav
  • 02_02.wav
  • and so on...
Put everything on the root of the card, no need to use directories. 

Step 3: Listen!
Hit 'CD' on your radio - the first selection will change to the built-in CD player.  The second time you hit 'CD', it will switch to our virtual CD changer.  The CD1 and CD2 buttons change between albums, and the left and right arrows change between tracks


Using it: Advanced Diagnostics

If you want to troubleshoot a slipping transmission, an A/C that never gets cold, or a Check Engine light, your Car Kracker can do just about everything.  Here's a walkthrough;

Setting it up takes two steps;

1 - Connect to your car
Connect your Car Kracker to your car and hold down the P6 button on boot up to enter diagnostics mode.  To do diagnostics on the engine / transmission, you'll need to connect to the OBD / diagnostic connector instead of the Trunk connection.

2 - Setup the software
The Car Kracker is going to provide a physical connection between your car and computer.  You're going to run software on your computer to actually collect the diagnostic data.  You have a few choices;

INPA is not commercial software, it can be found on 'the usual sources'.  I suspect it was originally for BMW re-certification and factory testing.  Downloads usually include NCSExpert, WinkFP, and a few other tools. 

INPA comes with EDIABAS, which needs to be configured.  In  c:\EDIABAS\BIN\EDIABAS.ini, make sure active interface is Interface =STD:OBD .  Also, your Car Hacker needs to be assigned to COM1.

With INPA installed, start INPA(_.IPO).  That will load EDIABAS and INPA will pop up.  Select the type of car you have and the diagnostics you want to run and you're off to the races!

Navcoder is commercial software, it is mostly designed to read accessory bus information (Radio / lights / Nav), not really for engine diagnostics.  However, it's pretty handy and easy to use, especially when you want to do things like remove the Nav warning screen or change the speed sensitive volume on the stereo;

The free version did everything I needed it to do, but I ended up buying it just to say thanks. 


Using it: Dealer Customizations

You can put the Car Kracker in diagnostics mode (Hold P7 on bootup) to make customizations to your car;

What are customizations?
Customizations are ways to control the default behaviors of the electronics in the car.  For instance;

  • Should the nav warning screen be displayed?
  • Should the gong sound be played whenever the door is open?
  • Should there always be daylight running lights?
And so on.  Only some things can be customized, it depends on the functionality of each module.  Customizations are stored even when the battery is disconnected, but they can be changed any number of times.  Personally, I turned off the 'Keys in ignition' gong and reduced the level of the speed sensitive steering.  Here's how to customize your car;

1 - Make sure INPA works
Also make sure you've installed NCSExpert, it usually comes with INPA.

2 - Use NCSExpert to change customizations
A full writeup on NCSExpert is up on M3 Cutters.  I also use NCSDummy (on Bimmerforums) because NCSExpert is entirely in German and can be hard to understand.

NCSExpert will generate a file (usually C:\NCSEXPER\WORK\NETTODAT.TRC), open NCSDummy and it will load that file and allow you to edit it easily.  Save the edit and write the revised file back to your car with NCSExpert.


Using it: Bus Sniffing

If you're an advanced user and just want to watch the data bus to see what's going on, hold down P7 on boot up to enter Bus Sniff mode.  This will show you the traffic on the databus in realtime;

Once you enter Bus Sniff mode, open up your Serial terminal program (Hyperterm, PuTTY, Parallax Serial Terminal) and connect to the COM port your Car Kracker is on at 115200 baud. 

  • The first byte of the message is the source; $00 = broadcast, $3B = Nav, $BF = Global
  • The second byte is the length of the message, counting from the third byte
  • The third byte is the destination - the mapping is the same as the source addresses
  • The 4th byte begins the data itself. 
  • The last byte is the checksum - it's calculated by XOR'ing each byte in the packet, here's the pseudo code;
    checksum := 0
    Repeat i from 0 to codelength
      checksum := checksum xor (BYTE[code][i])
There is no discovery method for finding out what commands each module supports.  The best way to figure it out is watch the bus while pushing buttons.  The example above is what the bus does when I unlock the door with the key fob;

$00 $04 $BF $72 $06
From: Broadcast ($00)  To: Global ($BF)
Data: $72 $06
Remote Unlock button pressed on Key fob

$00 $04 $BF $72 $26
From: Broadcast ($00)  To: Global ($BF)
Data: $72 $26
Remote Unlock button released

Using it: Advanced Hacking

The Car Kracker was written to be reused!  If you ever done a little programing, you can customize it to do all kinds of things.  First, download the code and install the Propeller Tool (download).  Open up 'KMB_Kracker_Demo.spin' and this is what you'll see;

This little program does two things; it helps you find your car in a crowded parking lot by blinking the clown nose when you hit unlock on your keys.  It also remaps the R/T button on your steering wheel to pop open your trunk. 

First, we start up the Kbus driver with Kbus.start(27,26), then we enter a loop.  The loop first waits for an incoming kbus code.  If the code matches 'remote home button pushed', it sends the 'Blink the Clown nose' code.  If it sees the RTbutton has been pushed, it sends a 'TrunkOpen' Code. 

Other functions available include;

Send text stored at the location given to the radio text display

Send text stored at the location give to the radio.  Scroll it if too long

Wait for time (given in milliseconds) for an incoming code.  Return -1 if no code was received.  Return 1 if a code was received.  The received code can then be compared using kbus.codecompare

Wait until an incoming code is received.  The received code can then be compared using kbus.codecompare. 

Reverse Engineering Your Car
All News - Projects
Written by Nicholas McClanahan   
Tuesday, 24 July 2012 13:07
How to go about hacking your car's data bus

Recently, I picked up a 2000 BMW 323i - it  didn't have an Aux-In (or tape deck), so I set out to add my own.

First, I poked around the trunk and found a CD changer connector.  Unfortunately, the radio wouldn't accept audio from the CD changer connection without thinking a changer was connected.  How hard could it be to fake a CD changer?

I scoped out the CD changer connector - all just sat at Ground or 12V except for one pin on a three pin connector.  It would toggle from ground to V+ right after the radio was turned on, whenever I pushed the unlock key on the remote, and when I pushed any button on the steering wheel.  The middle pin on the connector was always V+ and the outside pin was always ground - it was a servo-style header! 

I went back to the scope and recorded some transactions. Here's what happened when I hit the unlock key on the remote;

It seemed pretty interesting to me that the CD changer was being told about everything that was happening on the car.  It meant that the electronics on the car shared a communications line, which the CD changer was a member of.

By measuring the smallest flip, I figured the bitrate was 9600 baud.  After collecting more example transactions, it was clear that there was always an even number of 1's (even parity), 8 data bits, and 1 stop bit.  I plugged that in and started reading the bytes that were coming from the signal line. I got something like this;

First, I noticed the first byte was the same when I pushed buttons on the same device (key fob, steering wheel).  The second byte was certainly the length of the message. 

I figured out the third byte from watching the interior lights - when the interior lights changed, the source device would change, but the third byte was always the same.  I figured that must be a message to the lighting controller from different devices (when the door is unlocked, or when a timeout is reached, or when the interior lights button is pushed). 

But where are the commands and data?  Every 60 seconds, I would see a message like this;

80 0C FF 24 01 00 31 32 3A 31 37 50 4D 74

I knew what the first three bytes were.  Not sure about the next two bytes (01 00), but  $31 $32 $3A $31 $38 $50 $4D is ascii code for the text; "12:18PM" Ah ha!  The format of the command is SRC _ LEN _ DEST _ Payload _ Endbyte. 

Replaying the captured code would trigger the action (lights on / unlock, etc.).  I experimented by changed one byte and transmitted the code again, but no luck.   When I compared two similar commands (door lock, and door unlock), I noticed only two bytes changes - one byte in the beginning of the message and one byte at the end.  In fact, the byte at the end of the message was nearly always different.  I started to suspect the last byte was a checksum.  But what kind of checksum?

Not being a checksum expert, I just started with the Wikipedia article on checksums and tried each method on a small sample message; $00 $04 $BF $72 $16 $DF.  What checksum could I apply to the data that would result in the value $DF?  Thankfully, the first checksum listed on Wikipedia was the answer - each byte is Xor'ed.  So first I enter $04 into the calculator, then $BF and hit Xor.  Then I enter $72 and Xor.  Then $16 and Xor.  The result is $DF.

Off to Google
Changing the time display and unlocking the doors is pretty cool, but what else can I do?  Satisfied with my analysis, I started poking around to see what others had done. 

I realized I had just reverse engineered ISO 9141, which is a standard for diagnostics.  I confirmed that by looking at the pinout on my OBD connector - ISO 9141 pins were right there.  It turns out the car has two identical buses - one connects all the accessories, and a second connects the Engine, Transmission, and other devices.  I also found a bunch more codes to use. 

With the code library complete, I was ready to package everything up into a nice, user-friendly frontend.

Poker Buddy
All News - Projects
Written by Nicholas McClanahan   
Monday, 09 April 2012 10:21
Win more poker games with Poker Buddy, the pocket-sized Poker Computer.

Poker Buddy calculates the odds that you have the winning hand at each point in the game, so you can maximize your betting strategy.  Here's a little demo;


How much does it cost?
About $35. I'll give you a list of the parts and where to get them, then show you how to make it.

Aren't people going to notice it?
Poker Buddy is designed to be carried in your pocket, and runs on batteries.  The switches can be installed remotely (like in your shoes), so the only thing exposed will be your headphones. 

How's it work?
Poker Buddy is designed for Texas Holdem - as each card is dealt, you enter it with the two small switches.  At every stage of the game (Pre-flop, flop, turn, and river) the probability that you have the winning hand is calculated and the results are read to you over headphones. 

How do you enter cards?
First, you enter the number of other players.  each tap on the left button adds a player, then tapping on the right button locks in the number. 

Then, you enter the cards rank - each tap on the left button increases the rank from 2 to Ace.  The right button locks in the selection.  Finally, you enter the suit;  1 tap = club, 2 taps = diamonds, 3 = hearts, and 4 = spades. 

The odds will be calculated, and read to you.   After the flop, it waits for you to enter the three flop cards, then re-calculates the odds.  Same deal with the turn and river. 

How are the odds calculated?
Given the data you've provided Poker Buddy, it simulates 1,000 hands of poker and adds up how many times you would have won.  The advantage of this approach is that probabilities can be generated even with very little information.  The simulations run in multiple cores to complete quickly, as well. 

Can I change X?
Of course - the code and circuit are open source, so you're free to modify / change / tweak as you see fit. I'll give you a brief tour of the sourcecode, too.  If you want to jump ahead, here's the sourcecode.

Tutorial: Touchscreens
All News - Projects
Written by Nicholas McClanahan   
Wednesday, 28 March 2012 14:23
Add graphics, real-time information display, and a dynamic user interface to your microcontroller project with a touchscreen

In this tutorial, I'll show you how to use a touchscreen to:

  • Display true-color images
  • Create a dynamic user interface
  • Show data with gauges and dials
  • Use touchscreen input in your project

Continue and I'll show you a few demonstration projects to get you thinking, then I'll show you the parts you'll need and how to include a touchscreen with your project.

Tannenbaum Ticker
All News - Projects
Written by Nicholas McClanahan   
Monday, 19 December 2011 16:39
The Tannenbaum Ticker is a Christmas tree ornament that changes color based on how your stocks are doing

Here's a little demo;


US and international stocks, commodities, and bonds can be tracked, including market-wide and industry indexes  Trade data is polled every 30 seconds during the trading day.  The ticker goes from dark red ( > 4% drop from open), to green (within 0.2% of open), to blue ( > 4% increase from open).  There's also a 'short mode' to track short positions.  First, I'll answer a few questions, then I'll show you how to make your own!
Email Reading Reindeer
All News - Projects
Written by Nicholas McClanahan   
Tuesday, 13 December 2011 04:24
Rudolph, the Email Reading Reindeer, lets you know when you've got a new email and tells you who sent it!

Here's a demo;


Rudolph uses a Propeller Platform USB to log into the email server, trigger animations, and generate the speech.  An E-Net module handles the Internet connection.  First, I'll answer a few questions, then I'll show you how I built it, and I'll give you a few ideas on how to customize it for your own projects.

All News - Projects
Written by Jeff Ledger   
Tuesday, 29 November 2011 19:00

The completely self-contained retro gaming system for your PC.


It is capable of using the original Nintendo controller, the N64 controller, and the Wii Classic controller at the same time!

R/C Animator
All News - Projects
Written by Nicholas McClanahan   
Monday, 28 November 2011 09:16
Add sound effects to your R/C Vehicle!

R/C Animator lets you add sounds and lighting to your R/C car, airplane, helicopter, or boat. Effects are triggered with your R/C controller and can be combined.  Here's a demo;

Electric Flute
All News - Projects
Written by Jeff Ledger   
Tuesday, 15 November 2011 15:08

Convert a child's toy to a digitial instrument with breath/blow sensor.


Ok, first.. Yes, this isn't really a "flute", It's actually a "recorder", but this project will allow it to make sounds like a flute, recorder, or even weird space noises. Kids love this project!

Toilet Buddy
All News - Projects
Written by Nicholas McClanahan   
Tuesday, 08 November 2011 09:58
Say goodbye to embarrassing bathroom sounds, leaving the seat up, or forgetting to turn off the light with Toilet Buddy!

Here's a little demo of Toilet Buddy in action.

Toilet Buddy was inspired by Japanese toilets that play a 'Courtesy Flush' sound instead of actually flushing in order to save water. It also improves on the idea by reminding you to put the seat down and when you left the lights on.

First, I'll go over the design and show you how to make it. Then, I'll show you how Toilet Buddy can be adapted to projects that could use event-driven audio playback.

« StartPrev12NextEnd »

Page 1 of 2

Other Stuff

Get Our RSS Feed

Cool Project